This release includes early implementations of pandas extensions so that you can invoke msticpy functionality directly from a DataFrame:
my_events_df.mp_timeline.plot()
my_proc_events_df.mp_process_tree.plot()
So far, IoCExtract, Base64Unpack, Timeline and ProcessTree have these extensions but we will be adding them to more msticpy modules over time.
Also, IoCExtract and Base64 decode functions have IPython magics (%%ioc
and %%b64
) allowing you to paste a block of text into a notebook cell and run the function directly on that text.
Most other changes are primarily maintenance and house-keeping improvements such as increasing unit testing code coverage.
New Features
- process_tree - added pandas extension and changed main function so that it returns the plot figure and layout
- timeline - added pandas extension. added support for DateTime column in Tooltips (display as date time rather
than number) - base64unpack - added pandas extension, added IPython
%%b64
magic - iocextract - added pandas extension, added IPython
%%ioc
magic - Added documentation and notebook examples for the pandas extensions and magics.
- wsconfig - added method to display available workspaces
- README.MD - added some graphics to brighten the page up a little
- Added unit test test_folium.py
- Adding FoliumMap.ipynb sample notebook
- Added additional geolocation centering functions for FoliumMap
- Updates to GeoIPLookups.ipynb
- Add parameter checks to timeline.py and process_tree.py so that invalid **kwargs produced a helpful error message.
- Added requirements-dev.txt
Fixes
- Typos in AzureData.rst
- Adding GeoIP tests.
- Removing deprecated lines from coverage reports.
- Cleaned up pytest coverage report.
- Adding suppression file for credscan false positives
- Removing SecurityAlertandEntities notebook with misleading content
- Removed failing cell from end of GeoIPLookups notebook
- Fixed a few errors in foliummap.py
- Fixed bug in GeoIP DB downloader
- Changed foliummap center functions to use median by default
- Removed largely redundant os_family param from iocextract.py functions
- Fixed sectools_magics iocextract class
- Update test_ioc_extractor for new parameters
- domain_tools - changed tld_index and ssl_bl attributes to properties that auto-load on first use (prevents remote
http request if data on class instantiation) - Added more tests for utility.py
- Add environment variable to selectively run some long-duration tests during build only (these are no skipped in local tests)
- Tidied up/refactored some code in base64unpack.py